From 45376f15b903f74fef0e9b6ccefc7cfaf98258e4 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Feb 06 2025 14:42:08 +0000
Subject: [PATCH 1/3] fkinit: Use herestring for pass/OTP


For added security, pass the password and OTP directly via a BASH
herestring instead of via `echo`. This will avoid putting the value into
the process table.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

---

diff --git a/src/fkinit b/src/fkinit
index 4ec0766..1d53287 100755
--- a/src/fkinit
+++ b/src/fkinit
@@ -106,7 +106,7 @@ kinit -n @$domain -c FILE:$armorcache
 F_PASSWORD=$(systemd-ask-password "FAS password:")
 F_OTP=$(systemd-ask-password "FAS OTP (leave blank if not configured):")
 
-echo -n ${F_PASSWORD}${F_OTP} | kinit -T FILE:$armorcache $_arg_user@$domain >/dev/null
+kinit -T FILE:$armorcache $_arg_user@$domain <<< "${F_PASSWORD}${F_OTP}" >/dev/null
 unset F_PASSWORD
 unset F_OTP
 

From aecb137d1e8cf45188e068e92e49bd97eab5a841 Mon Sep 17 00:00:00 2001
From: Miro Hrončok <miro@hroncok.cz>
Date: Feb 06 2025 17:15:14 +0000
Subject: [PATCH 2/3] fkinit: Allow to pass the OTP token via $FKINIT_OTP


This allows me to run:

    $ FKINIT_OTP=$(ykman oath accounts code accounts.fedoraproject.org --single) fkinit

I can even alias this:

    $ alias fkinit='FKINIT_OTP=$(ykman oath accounts code accounts.fedoraproject.org --single) fkinit'

And the invocation then looks like this:

    $ fkinit
    Touch your YubiKey...
    🔐 FAS password: (press TAB for no echo)

Signed-off-by: Miro Hrončok <miro@hroncok.cz>

---

diff --git a/src/fkinit b/src/fkinit
index 1d53287..077678d 100755
--- a/src/fkinit
+++ b/src/fkinit
@@ -104,7 +104,7 @@ fi
 kinit -n @$domain -c FILE:$armorcache
 
 F_PASSWORD=$(systemd-ask-password "FAS password:")
-F_OTP=$(systemd-ask-password "FAS OTP (leave blank if not configured):")
+F_OTP=${FKINIT_OTP:-$(systemd-ask-password "FAS OTP (leave blank if not configured):")}
 
 kinit -T FILE:$armorcache $_arg_user@$domain <<< "${F_PASSWORD}${F_OTP}" >/dev/null
 unset F_PASSWORD

From 8122b45a8a00637441d5d94735eb3815268231cb Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Feb 06 2025 17:17:34 +0000
Subject: [PATCH 3/3] Add help documentation about $FKINIT_OTP variable


Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

---

diff --git a/src/fkinit b/src/fkinit
index 077678d..d2add1a 100755
--- a/src/fkinit
+++ b/src/fkinit
@@ -3,7 +3,7 @@
 # Created by argbash-init v2.10.0
 # ARG_OPTIONAL_SINGLE([user],[u],[Fedora account name],[$USER])
 # ARG_OPTIONAL_BOOLEAN([staging],[],[Use the staging infrastructure])
-# ARG_HELP([Acquire a Kerberos ticket-granting ticket for Fedora])
+# ARG_HELP([Acquire a Kerberos ticket-granting ticket for Fedora],[If the environment variable \$FKINIT_OTP is set, it will be read for the one-time password instead of prompting for it.])
 # ARGBASH_GO()
 # needed because of Argbash --> m4_ignore([
 ### START OF CODE GENERATED BY Argbash v2.10.0 one line above ###
@@ -37,8 +37,9 @@ print_help()
 	printf '%s\n' "Acquire a Kerberos ticket-granting ticket for Fedora"
 	printf 'Usage: %s [-u|--user <arg>] [--(no-)staging] [-h|--help]\n' "$0"
 	printf '\t%s\n' "-u, --user: Fedora account name (default: '$USER')"
-	printf '\t%s\n' "--staging: Use the staging infrastructure (off by default)"
+	printf '\t%s\n' "--staging, --no-staging: Use the staging infrastructure (off by default)"
 	printf '\t%s\n' "-h, --help: Prints help"
+	printf '\n%s\n' "If the environment variable \$FKINIT_OTP is set, it will be read for the one-time password instead of prompting for it."
 }
 
 
@@ -59,8 +60,9 @@ parse_commandline()
 			-u*)
 				_arg_user="${_key##-u}"
 				;;
-			--staging)
+			--no-staging|--staging)
 				_arg_staging="on"
+				test "${1:0:5}" = "--no-" && _arg_staging="off"
 				;;
 			-h|--help)
 				print_help